[vlc-commits] xiph: Fix potential buffer overflow

[Zinuo Han]

vlc/vlc-3.0 | branch: master | Zinuo Han <ele7enxxh at gmail.com> | Thu Feb 28 15:46:04 2019 +0100| [a947202827716f460c97b04896fb936f1f318ec0] | committer: Hugo Beauzée-Luyssen

xiph: Fix potential buffer overflow

https://hackerone.com/reports/502579

Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>
(cherry picked from commit 716d533181e8cc15085b30d265a76a9273228759)
Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=a947202827716f460c97b04896fb936f1f318ec0
---

 modules/demux/xiph.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/demux/xiph.h b/modules/demux/xiph.h
index 7d244286be..793023dea9 100644
--- a/modules/demux/xiph.h
+++ b/modules/demux/xiph.h
@@ -45,7 +45,7 @@ static inline unsigned int xiph_CountHeaders( const void *extra, unsigned int i_
         {
             uint16_t i_size = GetWBE( extra );
             p_extra += 2 + i_size;
-            if ( overall_len > i_extra - i_size )
+            if ( i_extra < i_size || overall_len > i_extra - i_size )
                 return 0;
             overall_len += i_size;
         }